Summary of the Pull Request

Adds a new Sigma rule to detect creation of AF_ALG (Address Family 38) sockets via the Linux socket() syscall as captured by auditd. AF_ALG is the Linux kernel crypto API userspace interface, exploited in CVE-2026-31431 for local privilege escalation via via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries.

This socket type has near-zero legitimate usage in production environments. Testing across ~500M CreateSocket events showed zero AF_ALG baseline activity. The rule was validated against a live exploit execution on Ubuntu 24.04 (kernel 6.17) with auditd syscall monitoring enabled.

Requires auditd rule: auditctl -a always,exit -F arch=b64 -S socket -k af_alg_detect

Changelog

new: Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator

Example Log Event

type=SYSCALL msg=audit(1777535219.002:917): arch=c000003e syscall=41 success=yes exit=4 a0=26 a1=80005 a2=0 a3=79b79360f868 items=0 ppid=7987 pid=8275 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=41 comm="python3" exe="/usr/bin/python3.12" subj=unconfined key="socket_creation"

Key fields:

• syscall=41 → socket()
• a0=26 → 0x26 = 38 decimal = AF_ALG
• a1=80005 → SOCK_SEQPACKET | SOCK_CLOEXEC (AEAD cipher mode)
• comm="python3" → exploit delivered via interpreter
• uid=1000 → non-root user initiating the exploit

Fixed Issues

N/A - New rule submission.

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions